Damn, there's gonna be a LOT of home/SOHO-type routers out there that are affected by this. I expect we'll see some exploits for these devices in the near future.
The other RCE is in the DNS subsystem, and can apparently be exploited by making a PTR record lookup to an attacker-controlled DNS server:
https://github.com/google/security-research-pocs/blob/master...
My first question is: can you induce people to make PTR lookups? I don't think there's a way to make a browser do a PTR lookup, which may limit the remote exploitability of this vulnerability.
My second question is: can the vulnerability be exploited with an A/AAAA record lookup instead? If so, that would open a very devastating remote attack vector, as a website would need only include a hidden image tag pointing to an attacker-controlled domain in order to get RCE on someone's router.
dnsmasq is used elsewhere, of course, but those deployments are far more likely to receive security updates.
That's very good news.
Edit: never mind, he says a CNAME answer to a A/AAAA query can trigger vulnerability. That's very bad news.
2.76 was only released 16 months ago though. There are probably tons of router firmwares out there that are way older than that.
(And most of the devices out there will never get updated even after this, just replaced one day)